Who we are
Mystic Engine is a UK-based collectible-goods trading brand and is responsible for deciding how the personal information described in this notice is used.
The legal operator's name, correspondence address and any company registration details are awaiting the final business-structure decision. They will be added before commerce or mailing-list collection begins.
Information we collect
What we collect depends on how you interact with Mystic Engine.
Information you give us
- Your name, email address and anything you include in an enquiry, message or customer-support conversation.
- Order, delivery and refund information when you make a purchase or ask us to prepare one.
- Marketing preferences when you choose to subscribe, unsubscribe or otherwise tell us how you would like to hear from us.
Website and commerce information
- Information needed to operate the site and cart, including necessary browser storage used to remember interface or cart state.
- Basic technical information such as IP address, browser or device information, requested pages, timestamps and security records.
- Order, payment-status, delivery and refund records. Payment-card details are processed by our payment provider and are not stored directly by Mystic Engine.
Social-media information
- Information made available when you interact with Mystic Engine on Instagram, Facebook, Threads or another social platform, such as your username, public profile identifier, comments, replies, messages, mentions and reactions.
- Content and media associated with Mystic Engine’s professional accounts.
- Performance information such as reach, views, interactions, clicks and aggregated audience insights.
Marketing and advertising information
- Campaign, referral and response information used to understand whether a promotion or advertisement was useful.
- Conversion or audience information if we introduce advertising measurement. We will provide appropriate information and choices before using non-essential cookies or similar tracking where required.
Technical and operational records
- Request and webhook-delivery logs, security events, connection records and records of actions taken through authorised operational systems.
- Professional-account identifiers and credentials needed to maintain approved connections to services such as Meta. Credentials are protected and access is restricted.
We do not intentionally collect special-category personal information.
How we use information
We use personal information to:
- Operate the Mystic Engine website and social-media accounts.
- Publish and manage content.
- Observe, moderate and reply to comments and messages.
- Respond to questions and provide customer support.
- Understand how content and products perform.
- Send requested marketing, measure promotions and honour communication preferences.
- Process purchases, delivery, refunds and related records.
- Protect our accounts, services and customers from misuse or security threats.
- Maintain auditable operational records.
- Meet legal, accounting and regulatory obligations.
Our lawful bases
Depending on the activity, we rely on:
- Legitimate interests to operate and improve Mystic Engine, manage its public presence, respond to interactions, understand performance and maintain security.
- Contract when information is needed to take steps at your request or fulfil a purchase.
- Legal obligation where records must be retained or disclosed under applicable law.
- Consent where required, including for optional marketing or non-essential tracking. Consent may be withdrawn at any time.
You may object to processing based on legitimate interests by contacting us.
Sharing and transfers
Information may be processed by:
- Social-media platforms, including Meta and Instagram, when you interact with Mystic Engine through their services.
- Cloudflare, which provides hosting, storage and infrastructure.
- Google Fonts, which currently supplies the storefront typeface and receives the technical information needed to serve it. This dependency may be replaced by self-hosted fonts before launch.
- Stripe and other payment or commerce providers when purchases are enabled.
- Delivery, email, accounting and customer-support providers where required.
- Authorised hosting, software and operational service providers that help us run, secure and support Mystic Engine, where access is necessary for those services.
- Professional advisers, regulators or public authorities where legally required.
We do not sell personal information.
Where a provider processes information outside the United Kingdom, we use an appropriate legal transfer mechanism, such as an applicable adequacy regulation or approved contractual safeguards.
Retention
We keep personal information only while it is reasonably needed for the purposes described above.
Our working retention periods are:
- Staged social-media assets: up to 90 days after publication or cancellation.
- Enquiries, social interactions and operational records: up to 24 months, unless needed for an active conversation, dispute, security investigation or legal requirement.
- Security and webhook-delivery logs: up to 12 months.
- OAuth credentials: until the account is disconnected, access is revoked or the credential expires.
- Marketing records: until you unsubscribe or object, plus a minimal suppression record where needed to respect that choice.
- Financial and transaction records: for the period required by UK tax and accounting law.
We may retain anonymised or aggregated information that no longer identifies an individual.
Your rights
Depending on the circumstances, you may have rights to:
- Request access to your personal information.
- Correct inaccurate information.
- Request erasure.
- Restrict how information is used.
- Object to processing based on legitimate interests.
- Receive certain information in a portable format.
- Withdraw consent where processing relies on consent.
To exercise a right, contact [email protected]. We may need to verify your identity.
You may also complain to the UK Information Commissioner’s Office at ico.org.uk.
Instagram and Meta
Mystic Engine connects its own professional social-media accounts to Meta’s services. Depending on the permissions enabled, this connection may be used to publish and manage content, read performance information, observe and moderate interactions, and respond to comments or messages.
When you interact with Mystic Engine through a Meta service, Meta also processes information under its own terms and privacy policy.
You may remove Mystic Engine’s access through your Meta or Instagram account settings. You may also request deletion of information held by Mystic Engine by emailing [email protected]. Requests received through Meta’s official data-deletion process will be handled through our configured deletion endpoint.
Removing access does not require us to delete records that must be retained for legal, security or dispute-resolution purposes.
Cookies and local storage
Mystic Engine currently uses only browser storage necessary to provide requested functionality, such as preserving interface or cart state.
We will not introduce optional analytics or advertising cookies without providing appropriate information and choices where required.
You can see the current storage register and record your choices on the storage choices page.
Children
Mystic Engine’s online services are not directed at children under 13. If you believe a child has provided personal information without appropriate permission, contact us.
Changes
We may update this notice when our services or data practices change. The current version and its effective date will remain available on this page.